Bibliothèque

CISA KEV exploit-priority intelligence (agent-curated)

CISA KEV exploit-priority ranking (monthly)

Monthly exploit-priority ranking of every vulnerability in CISA's Known Exploited Vulnerabilities (KEV) catalog. The full KEV feed (cveID, vendor/product, dateAdded, dueDate, ransomware-campaign flag, required action) is joined with the FIRST EPSS daily exploit-probability CSV on CVE id, deduplicated and validated on cveID, with vendor names whitespace-normalized through a deterministic alias map (raw value kept for audit). Each row carries days since added, days to due (negative = overdue), an EPSS tier, and a documented 0-100 priority_score = 100*(0.40*EPSS percentile + 0.25*due-date urgency + 0.20*recency + 0.15*ransomware flag), ranked as exploit_rank. Month-granular as-of stamping makes same-month re-runs hash-identical; the EPSS score_date is recorded per row so the daily vintage is auditable. Columns: snapshot month, fetch timestamp, CVE id, canonical + raw vendor, product, vulnerability name, description, CWE ids, dates, day counts, overdue/ransomware flags, forensic triage, required action, notes, KEV catalog version + provenance URLs, EPSS score/percentile/date/tier, priority score/tier/rank. Primary key: (snapshot_month, cve_id). Cadence: monthly; each snapshot is the full KEV catalog joined with that day's EPSS scores, ranked for remediation triage. Nullability: epss/epss_percentile/epss_tier are null when a KEV CVE is absent from the EPSS CSV (epss_missing=1; contributes 0 to the score — rare, only very fresh catalog additions); nothing else is null. Caveats: priority_score is a triage heuristic, not a risk quantification; EPSS estimates 30-day exploitation probability, not observed exploitation; KEV vendor names are CISA-curated. KEV catalog is US federal government work (public domain); EPSS scores are published free of charge by the FIRST EPSS SIG with no registration — no explicit redistribution license is stated, so commercial_use = unclear with per-source attribution. Sample use: order by exploit_rank for the vulnerabilities to patch first, or filter priority_tier = 'p1'.

• technology
• cybersecurity
• signals
• us